Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : How to trace the source of spoofed ip?

[nowisph]

I heard a command in Cisco core router (10000/12000) can do this, but that would take a lot of time waiting for DC to take action, can we trace the source of spoofed ip from our firewall/router?

[racksense]

You can't. Since it is spoofed the header of the packet will be faked, there is no other information you can use.

The upstream provider will look to see what transit or peering exchange the packet(s) came via to work out where it was spoofed from, this process then has to go all the way along the route via each provider to eventually you find the source ISP.

[nowisph]

but aren't there a reverse traceroute method?

[racksense]

The packet is spoofed! This means that the IP header has been fiddled with, this means the IP address on the packet header is different to where the packet actually originated. Traceroute to that IP will not give you the real answer as to the source.